Privacy Notice

1. Who we are

This notice is issued by:

2. What personal data do we collect about you

In accordance with Rule 3(b)(i) of the DPDP Rules, 2025, the following is an itemised description of each category of personal data Saral AI collects about candidates:

We do not collect Aadhaar numbers, PAN, biometric data, health data, financial data, religious or political beliefs, sexual orientation, or any other sensitive personal information.

3. Why we process your data, purpose and service description

In accordance with Rule 3(b)(ii), the following describes the specific purpose for which each category of data is processed, and the service it enables. Saral AI does not use your data for any purpose not listed here.

Your data is never used for: advertising, marketing to you on behalf of third parties, sale to data brokers, insurance or credit scoring, political profiling, employee surveillance, or training of AI models for any purpose other than Saral AI's own sourcing quality.

4. The legal basis for processing your data

Under Sections 3(c)(ii), 4, 5, and 6 of the DPDP Act, 2023, Saral AI processes candidate personal data on the following documented legal bases:

4.1 Public data exemption — Section 3(c)(ii) DPDP Act

Personal data that you have caused to be made publicly available falls outside the scope of the DPDP Act by law. Saral AI relies on this for:

• GitHub: your public username, bio, public repositories, programming languages, contribution graphs, and publicly visible commit activity
• X (Twitter): your public handle, bio, and any contact details you have publicly posted
• LinkedIn: your publicly visible professional profile including name, role, employer, skills, and education

We only rely on this exemption where you deliberately made the data public. We do not rely on it for data that you shared only within a platform's closed community or that was made public without your knowledge.

4.2 Consent — Section 6 DPDP Act

Where Saral AI collects data beyond the public exemption, specifically, enriched email addresses or phone numbers sourced through third-party tools, we require our enrichment vendors to hold their own documented consent chain from you. We do not use the public data exemption for enriched contact data. If you believe enriched contact data about you was collected without a valid legal basis, you have the right to request its deletion immediately.

4.3 What this means in practice

5. How long we keep your data

In accordance with the purpose limitation and erasure principles under the DPDP Act and Rule 8 of the DPDP Rules, 2025:

6. Who can see your data

Saral AI does not sell your data. Access to your profile is restricted as follows:

7. Automated evaluation — the Fit Check

Saral AI uses artificial intelligence to generate a “Fit Check” evaluation of your profile against a recruiter's stated role requirements. You have the right to know this is happening, and you have rights to challenge it.

8. Where your data is stored — cross-border transfers

Saral AI's infrastructure may involve processing or storage of data outside India through cloud and related services. In accordance with Section 16 of the DPDP Act, such cross border processing is permitted where not restricted by the Government of India and is governed by data processing agreements with our service providers.

Data may be processed across multiple regions depending on infrastructure, redundancy, and performance requirements. Saral AI does not guarantee or fix specific geographic locations of data processing.

Appropriate technical and organisational safeguards are implemented to ensure a level of data protection consistent with applicable laws.

9. Your rights under the DPDP Act, 2023

The following rights are guaranteed to you by law under the Digital Personal Data Protection Act, 2023. Saral AI is required to facilitate each of them. You do not need to justify your request or provide a reason.

10. How we respond to your requests — published SLA

In accordance with Rule 14 of the DPDP Rules, 2025, Saral AI is required to publish the timeframes within which we respond to data rights requests. These are binding commitments, not targets:

11. If there is a data breach

If we become aware of a breach that affects your personal data, we are required under Rule 7 of the DPDP Rules, 2025 to:

1. Notify you without delay, in plain language, describing the nature of the breach, what data was affected, what consequences you may face, and what steps we are taking
2. Submit a detailed report to the Data Protection Board of India within 72 hours of becoming aware of the breach
3. Take immediate steps to contain the breach and prevent further harm

We will notify you via the email address or contact details that are publicly associated with your profile. If you have submitted a removal request and your contact data is no longer in our system, we will make a public notification on our website.

12. How to remove your data — step by step

Per Rule 3(c)(i) of the DPDP Rules, 2025, removing your data must be as easy as any original data collection. Here is the exact process:

1. Go to saralhire.ai/remove-my-data
2. Enter your full name and the email address associated with your public profile
3. Click Submit — that is all that is required. No account, no verification, no additional steps.
4. You will receive an acknowledgement within 72 hours
5. We will send a 48-hour pre-deletion notice to your email before executing any deletion
6. Your profile will be permanently deleted within 30 days
7. We will notify all recruiters who accessed your profile to delete their copies within a further 30 days

You can also email privacy@saralhire.ai with the subject line “Remove my data” if you prefer email over the form.

The link to this page appears in: the footer of saralhire.ai, the footer of every recruiter outreach email sent via our platform, and this Privacy Notice. This ensures you can always reach it from any touchpoint.

13. This notice in other languages

In accordance with Rule 3 of the DPDP Rules, 2025 and the Eighth Schedule of the Constitution of India, this Privacy Notice is available in English as the primary language. Translations are available or being prepared in the following Indian languages:

14. Updates to this notice

We review and update this Privacy Notice at least once every 12 months, and additionally whenever the DPDP Act or Rules change, or when our data practices change materially.

If we make a material change, we will publish the updated notice at saralhire.ai/privacy and, where we hold your contact information, send you a direct notification at least 30 days before the change takes effect. The version number and effective date on the cover page will reflect each update.

The current version of this notice is always accessible at saralhire.ai/privacy.

15. How to contact us — and how to complain

15.1 Contact Saral AI directly

15.2 If we do not resolve your concern

If you are not satisfied with how we handled your request, you may escalate the matter to the Data Protection Board of India, the statutory authority under the DPDP Act.